PE-sieve
Scans all running processes. Recognizes and dumps a variety of potentially malicious implants (replaced/implanted PEs, shellcodes, hooks, in-memory patches).
Toggle main menu visibility
Loading...
Searching...
No Matches
utils
dbg_help_wrapper.h
Go to the documentation of this file.
1
#pragma once
2
3
#include <windows.h>
4
#include <dbghelp.h>
5
#pragma comment(lib, "dbghelp.lib")
6
7
#include <iostream>
8
#include <mutex>
9
#include <unordered_map>
10
#include <string>
11
12
class
DbgHelpWrapper
13
{
14
public
:
15
16
static
bool
InitializeProcess
(HANDLE hProcess,
const
std::string& symbolPath, DWORD symOptions)
17
{
18
std::lock_guard<std::mutex> guard(m_Mutex);
19
20
SessionInfo& session = sessions[hProcess];
21
22
if
(session.refCount > 0) {
23
++session.refCount;
24
return
true
;
25
}
26
27
SymSetOptions(symOptions);
28
29
if
(!SymInitialize(hProcess, symbolPath.empty() ?
nullptr
: symbolPath.c_str(), FALSE)) {
30
session.lastError = GetLastError();
31
return
false
;
32
}
33
34
if
(!symbolPath.empty()) {
35
SymSetSearchPath(hProcess, symbolPath.c_str());
36
}
37
38
session.initialized =
true
;
39
session.refCount = 1;
40
session.lastError = ERROR_SUCCESS;
41
return
true
;
42
}
43
44
static
bool
CleanupProcess
(HANDLE hProcess)
45
{
46
std::lock_guard<std::mutex> guard(m_Mutex);
47
48
std::unordered_map<HANDLE, SessionInfo>::iterator it = sessions.find(hProcess);
49
50
if
(it == sessions.end()) {
51
return
true
;
52
}
53
54
SessionInfo& session = it->second;
55
56
if
(session.refCount > 1) {
57
--session.refCount;
58
return
true
;
59
}
60
61
if
(session.initialized) {
62
if
(!SymCleanup(hProcess)) {
63
session.lastError = GetLastError();
64
return
false
;
65
}
66
}
67
sessions.erase(it);
68
return
true
;
69
}
70
71
static
bool
RefreshModuleList
(HANDLE hProcess)
72
{
73
std::lock_guard<std::mutex> guard(m_Mutex);
74
75
if
(!SymRefreshModuleList(hProcess)) {
76
return
false
;
77
}
78
return
true
;
79
}
80
81
static
bool
RunStackWalk64
(
82
_In_ DWORD MachineType,
83
_In_ HANDLE hProcess,
84
_In_ HANDLE hThread,
85
_Inout_ LPSTACKFRAME64 StackFrame,
86
_Inout_ PVOID ContextRecord,
87
_In_opt_ PREAD_PROCESS_MEMORY_ROUTINE64 ReadMemoryRoutine,
88
_In_opt_ PFUNCTION_TABLE_ACCESS_ROUTINE64 FunctionTableAccessRoutine,
89
_In_opt_ PGET_MODULE_BASE_ROUTINE64 GetModuleBaseRoutine,
90
_In_opt_ PTRANSLATE_ADDRESS_ROUTINE64 TranslateAddress
91
)
92
{
93
std::lock_guard<std::mutex> guard(m_Mutex);
94
if
(StackWalk64(MachineType, hProcess, hThread, StackFrame, ContextRecord, ReadMemoryRoutine, FunctionTableAccessRoutine, GetModuleBaseRoutine, TranslateAddress)) {
95
return
true
;
96
}
97
return
false
;
98
}
99
100
static
bool
FromAddress
(HANDLE hProcess, DWORD64 address, PSYMBOL_INFO symbol, DWORD64* displacement)
101
{
102
std::lock_guard<std::mutex> guard(m_Mutex);
103
if
(!SymFromAddr(hProcess, address, displacement, symbol)) {
104
return
false
;
105
}
106
return
true
;
107
}
108
109
static
bool
GetModuleInfo
(HANDLE hProcess, DWORD64 address, IMAGEHLP_MODULE64* moduleInfo)
110
{
111
std::lock_guard<std::mutex> guard(m_Mutex);
112
113
moduleInfo->SizeOfStruct =
sizeof
(IMAGEHLP_MODULE64);
114
if
(!SymGetModuleInfo64(hProcess, address, moduleInfo)) {
115
return
false
;
116
}
117
return
true
;
118
}
119
120
static
DWORD
GetLastErrorForProcess
(HANDLE hProcess)
121
{
122
std::lock_guard<std::mutex> guard(m_Mutex);
123
124
auto
it = sessions.find(hProcess);
125
if
(it == sessions.end()) {
126
return
ERROR_INVALID_HANDLE;
127
}
128
return
it->second.lastError;
129
}
130
131
private
:
132
133
struct
SessionInfo
134
{
135
bool
initialized;
136
size_t
refCount;
137
DWORD lastError;
138
139
SessionInfo()
140
: initialized(false),
141
refCount(0),
142
lastError(ERROR_SUCCESS)
143
{
144
}
145
};
146
147
static
std::mutex m_Mutex;
148
static
std::unordered_map< HANDLE, SessionInfo> sessions;
149
};
DbgHelpWrapper
Definition
dbg_help_wrapper.h:13
DbgHelpWrapper::FromAddress
static bool FromAddress(HANDLE hProcess, DWORD64 address, PSYMBOL_INFO symbol, DWORD64 *displacement)
Definition
dbg_help_wrapper.h:100
DbgHelpWrapper::CleanupProcess
static bool CleanupProcess(HANDLE hProcess)
Definition
dbg_help_wrapper.h:44
DbgHelpWrapper::GetModuleInfo
static bool GetModuleInfo(HANDLE hProcess, DWORD64 address, IMAGEHLP_MODULE64 *moduleInfo)
Definition
dbg_help_wrapper.h:109
DbgHelpWrapper::RefreshModuleList
static bool RefreshModuleList(HANDLE hProcess)
Definition
dbg_help_wrapper.h:71
DbgHelpWrapper::GetLastErrorForProcess
static DWORD GetLastErrorForProcess(HANDLE hProcess)
Definition
dbg_help_wrapper.h:120
DbgHelpWrapper::InitializeProcess
static bool InitializeProcess(HANDLE hProcess, const std::string &symbolPath, DWORD symOptions)
Definition
dbg_help_wrapper.h:16
DbgHelpWrapper::RunStackWalk64
static bool RunStackWalk64(_In_ DWORD MachineType, _In_ HANDLE hProcess, _In_ HANDLE hThread, _Inout_ LPSTACKFRAME64 StackFrame, _Inout_ PVOID ContextRecord, _In_opt_ PREAD_PROCESS_MEMORY_ROUTINE64 ReadMemoryRoutine, _In_opt_ PFUNCTION_TABLE_ACCESS_ROUTINE64 FunctionTableAccessRoutine, _In_opt_ PGET_MODULE_BASE_ROUTINE64 GetModuleBaseRoutine, _In_opt_ PTRANSLATE_ADDRESS_ROUTINE64 TranslateAddress)
Definition
dbg_help_wrapper.h:81
Generated by
1.17.0